KYA Pro API · v1

Runtime governance, as an API.

Record every action your AI agents take. Give them time-limited permissions. Pass authority between agents with portable proof. Produce audit reports regulators can verify on their own — all backed by a tamper-proof evidence trail.

Base URL

production

https://api.veldtlabs.ai

What's in this API

Resource	What it represents
Accounts	Workspaces, email sign-in, API tokens, current session
Actions	Events your runtime sends us — the ingest surface
Evidence	The signed, tamper-proof audit trail for every action

Advanced surfaces — available on request: Agents, Principals, Delegations, Compliance packs. Email [email protected] and we'll onboard you with the full docs, a walkthrough, and a sandbox.

Reference

Authentication — bearer tokens, permissions, which token each endpoint needs
Errors — the shared error format and HTTP status codes
Security — workspace isolation, signed evidence, PII redaction, rate limits

Setup

Set one env var, then every curl below will work:

bash

export VELDT_KYA_TOKEN=kya_live_your_token_here

Get your token by signing up at app.veldtlabs.ai → Identity & Security → Connect Agent → Generate API key. Or use POST /api/v1/accounts/tokens (see Accounts).

Running KYA yourself? If you host Veldt on your own infrastructure, you may want a separate shared collector token instead of using your customer token for ingest — see Authentication › Ingress tokens. Cloud customers don't need one.

Quickstart

Three curl calls to a working audit trail. Runs against the KYA Pro cloud at https://api.veldtlabs.ai.

1. Sign up

bash

curl -X POST https://api.veldtlabs.ai/api/v1/accounts/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]"}'

A 6-digit code is sent to your inbox.

2. Verify and receive your first token

bash

curl -X POST https://api.veldtlabs.ai/api/v1/accounts/verify \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "code": "482910"}'

json response

{
  "token": "kya_live_a1b2c3d4e5f6…",
  "account": {
    "id": "e782d920-…",
    "email": "[email protected]",
    "plan_tier": "team"
  },
  "tenant_id": "abcd0000-…"
}

Save the token now. token is the API key for every later call. It is shown once. If you lose it, issue a new one.

3. Record your first agent action

Agents register themselves on first sight — no separate registration call.

bash

curl -X POST https://api.veldtlabs.ai/api/v1/admin/agents/events/invocation \
  -H "Authorization: Bearer $VELDT_KYA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_key":   "billing.orchestrator",
    "mode":        "observed",
    "outcome":     "success",
    "duration_ms": 142,
    "prompt":      "Summarize Q3 invoice exceptions",
    "response":    "3 invoices exceed threshold: ..."
  }'

json response

{
  "invocation_id": 91827,
  "tenant_id":     "abcd0000-…",
  "verdict":       "allow",
  "evidence_id":   555,
  "pii_count":     0
}

verdict is decided at write time (allow / flag_for_review / deny). evidence_id appears when a signed audit-trail entry was written. pii_count appears when tool_input contained PII.

That's the ingest loop. From here, KYA can produce signed, regulator-verifiable compliance packs against this evidence trail — email [email protected] to be onboarded.